Hello Team,
We are currently ingesting logs from two different organizations into a single Google SecOps instance, with logs segregated using namespaces during ingestion.
Our requirement is to use common detection rules across both organizations while ensuring that alerts are routed to their respective Google SecOps SOAR environments.
The expected routing is as follows:
-
Organization 1: Alerts should be routed to Environment 1 (SOC Team 1).
-
Organization 2: Alerts should be routed to Environment 2 (SOC Team 2).
Current Approach
We have configured common YARA-L detection rules and are using the namespace field in the rule outcome to identify the originating organization and route alerts to the appropriate SOAR environment.
During testing, this approach worked as expected in most scenarios.
Issue Observed
In certain cases, the namespace field does not contain the expected namespace value. Although the field is present, its value appears as "outcome" instead of the actual namespace.
As a result, some alerts are not correctly segregated or routed to their respective environments.
Additional Requirement – Curated Detections
Apart from our custom YARA-L detection rules, we are also using Google SecOps curated detections.
Since curated detections are managed by Google, we would like to understand how alerts generated by these detections can be segregated based on the originating organization's logs.
Specifically, when a curated detection triggers on events belonging to Organization 1 or Organization 2, we need the corresponding alert to be routed to the respective SOAR environment.
Looking forward for your suggestions.
Thank you in advance
